When designing a secure email architecture, placement is everything. The goal is to create multiple layers of defense, isolating your internal network from direct internet exposure. This is where a DMZ comes in. By placing your email security gateways within this perimeter network, you create a controlled buffer zone.

The best practice is a layered approach. FortiMail sits at the very edge, acting as the first point of contact for all incoming email from the internet. It serves as the primary Mail Transfer Agent (MTA) and performs the initial, heavy-duty security scanning. Behind it, but still within the DMZ, sits the Microsoft Exchange Edge Transport server. This server handles more specific policy enforcement before the mail is finally relayed to the internal Exchange Mailbox servers.

This setup provides clear separation of duties. FortiMail handles the frontline battle against spam, viruses, and other threats in its powerful hygiene layer before they even get close to your Microsoft infrastructure. The Exchange Edge server then takes the 'cleaner' traffic and applies your organization's specific business logic, such as transport rules that might redirect emails or add disclaimers. It can also handle complex address rewriting, which is useful for things like mergers or domain name changes.

For this traffic flow to work, you must configure your firewalls to allow specific traffic. These rules ensure that only legitimate email traffic can pass between the zones. You need a rule on your external firewall allowing SMTP traffic from the internet to your FortiMail appliance. Then, you need rules on the internal firewall to allow the Exchange Edge server to communicate with your internal Mailbox servers.

Note the inclusion of other common ports. TCP ports 465 (SMTPS) and 587 (submission) are also frequently used for secure and authenticated email relay. DNS on port 53 is critical for mail servers to look up MX records and route mail correctly. Finally, port 443 is necessary for you to securely manage the appliances through their web interfaces.

The diagram above shows a single DMZ. It's a common and effective setup that is relatively straightforward to manage. All internet-facing email services reside in the same network segment, protected by two firewalls.

A more advanced, higher-security alternative is a tiered DMZ, also known as a screened subnet. In this design, FortiMail would live in the first DMZ (the 'outer' tier), directly exposed to the internet. The Exchange Edge server would live in a second, separate DMZ (the 'inner' tier), sandwiched between the first DMZ and the internal network. Communication between the two tiers would be strictly controlled by an intermediary firewall.

For most organizations, a single, properly configured DMZ offers a strong balance of security and manageability. The key is strict firewall rules and keeping the appliances patched and updated.